PT-2024-34090 · Linux+7 · Linux Kernel+7
Wang Liang
·
Published
2024-10-23
·
Updated
2026-05-26
·
CVE-2024-50258
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
A crash can occur in the Linux kernel when a small
gso max size or gso ipv4 max size is configured, leading to an underflow in sk dst gso max size(). This underflow may trigger a BUG ON crash because sk->sk gso max size would be much bigger than device limits. The issue is related to the tcp write xmit function, where tso segs is calculated using DIV ROUND UP(skb->len, mss now), which can result in a value of 0, triggering the BUG ON crash. A check for the minimum value of gso max size and gso ipv4 max size has been added to fix the issue.Recommendations:
For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider configuring a larger
gso max size and gso ipv4 max size to avoid the underflow issue. Restrict access to the tcp write xmit function and related tcp set skb tso segs and tcp skb pcount set functions to minimize the risk of exploitation. Avoid using small values for gso max size and gso ipv4 max size until the issue is resolved.Exploit
Fix
DoS
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu